HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSS

The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

The “htmega_call_to_action” widget accepts a “callto_action_title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request containing JavaScript in the “callto_action_title_tag” parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.

The “htmega_section_title” widget accepts a “section_title_tag” and a “section_subtitle_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request containing JavaScript in these parameters, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.

The “htmega_accordion” widget accepts a “accourdion_title_html_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request containing JavaScript in the “accourdion_title_html_tag” parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.

Additionally the following appear to have similar vulnerabilities:
bl_page_title: title_html_tag parameter
bl_post_archive_title: title_html_tag parameter
bl_post_title: blog_title_html_tag parameter 
bl_post_author_info: name_html_tag parameter
bl_site_title: title_html_tag parameter

These vulnerabilities are nearly identical to the vulnerabilities we have recently disclosed in the main Elementor plugin: https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/